ff357da · typeable/oauth2-proxy

CHANGELOG.md+1

@@ -13,6 +13,7 @@

13- [#2685](https://github.com/oauth2-proxy/oauth2-proxy/pull/2685) feat: allow arbitrary claims from the IDToken and IdentityProvider UserInfo endpoint to be added to the session state (@vegetablest)

14- [#3278](https://github.com/oauth2-proxy/oauth2-proxy/pull/3278) feat: possibility to inject id_token in redirect url during sign out (@albanf)

15- [#2851](https://github.com/oauth2-proxy/oauth2-proxy/pull/2851) feat: add support for specifying allowed OIDC JWT signing algorithms (#2753) (@andoks / @tuunit)

16+- [#3369](https://github.com/oauth2-proxy/oauth2-proxy/pull/3369) fix: use CSRFExpire instead of Expire for CSRF cookie validation (@Br1an67)

16

17

17# V7.14.3

18# V7.14.3

18

19

pkg/cookies/csrf.go+1−1

@@ -234,7 +234,7 @@ func decodeCSRFCookie(cookie *http.Cookie, opts *options.Cookie) (*csrf, error)

234 return nil, fmt.Errorf("error getting cookie secret: %v", err)

235 }

236

237− val, t, ok := encryption.Validate(cookie, secret, opts.Expire)

237+ val, t, ok := encryption.Validate(cookie, secret, opts.CSRFExpire)

238 if !ok {

239 return nil, errors.New("CSRF cookie failed validation")

240 }

pkg/cookies/csrf_test.go+25−1

@@ -119,9 +119,33 @@ var _ = Describe("CSRF Cookie Tests", func() {

119 Value: encoded,

120 }

121

122− _, _, valid := encryption.Validate(cookie, cookieOpts.Secret, cookieOpts.Expire)

122+ _, _, valid := encryption.Validate(cookie, cookieOpts.Secret, cookieOpts.CSRFExpire)

123 Expect(valid).To(BeTrue())

124 })

125+

126+ It("validates CSRF token using CSRFExpire when Expire is lower", func() {

127+ // Set Expire to be much lower than CSRFExpire

128+ cookieOpts.Expire = time.Second

129+ cookieOpts.CSRFExpire = time.Hour

130+

131+ privateCSRF.OAuthState = []byte(csrfState)

132+ privateCSRF.OIDCNonce = []byte(csrfNonce)

133+

134+ encoded, err := privateCSRF.encodeCookie()

135+ Expect(err).ToNot(HaveOccurred())

136+

137+ cookie := &http.Cookie{

138+ Name: privateCSRF.cookieName(),

139+ Value: encoded,

140+ }

141+

142+ // The cookie should still be valid even though Expire is only 1 second

143+ decoded, err := decodeCSRFCookie(cookie, cookieOpts)

144+ Expect(err).ToNot(HaveOccurred())

145+ Expect(decoded).ToNot(BeNil())

146+ Expect(decoded.OAuthState).To(Equal([]byte(csrfState)))

147+ Expect(decoded.OIDCNonce).To(Equal([]byte(csrfNonce)))

148+ })

125 })

149 })

126

150

127 Context("Cookie Management", func() {

151 Context("Cookie Management", func() {